已知某些站使用的是阿里云的WAF,他是有着一个验证,如果acw_sc__v2参数没有计算成功,那么请求均会失效。
弹出的页面中,他是有着下面的代码:
var arg1='A666AB682A26885DCDD57662B25048454F91F92B';
VB.NET 代码:
Imports System.Text
Public Class AlgoCalculator
Private Shared ReadOnly MapArray As Integer() = {
&HF, &H23, &H1D, &H18, &H21, &H10, &H1, &H26, &HA, &H9,
&H13, &H1F, &H28, &H1B, &H16, &H17, &H19, &HD, &H6, &HB,
&H27, &H12, &H14, &H8, &HE, &H15, &H20, &H1A, &H2, &H1E,
&H7, &H4, &H11, &H5, &H3, &H1C, &H22, &H25, &HC, &H24
}
Private Const SECRET_KEY As String = "3000176000856006061501533003690027800375"
Public Shared Function Calculate(arg1 As String) As String
If String.IsNullOrEmpty(arg1) Then Return ""
Dim scrambled As String = Unsbox(arg1)
Dim result As String = HexXor(scrambled, SECRET_KEY)
Return result
End Function
Private Shared Function Unsbox(input As String) As String
Dim outputChars(MapArray.Length - 1) As Char
For j As Integer = 0 To MapArray.Length - 1
Dim inputIndex As Integer = MapArray(j) - 1
If inputIndex < input.Length Then
outputChars(j) = input(inputIndex)
Else
outputChars(j) = " "c
End If
Next
Return New String(outputChars)
End Function
Private Shared Function HexXor(inputStr As String, keyStr As String) As String
Dim sb As New StringBuilder()
Dim length As Integer = Math.Min(inputStr.Length, keyStr.Length)
For i As Integer = 0 To length - 1 Step 2
If i + 1 >= inputStr.Length OrElse i + 1 >= keyStr.Length Then Exit For
Dim hex1 As String = inputStr.Substring(i, 2)
Dim val1 As Integer = Convert.ToInt32(hex1, 16)
Dim hex2 As String = keyStr.Substring(i, 2)
Dim val2 As Integer = Convert.ToInt32(hex2, 16)
Dim xorResult As Integer = val1 Xor val2
sb.Append(xorResult.ToString("X2").ToLower())
Next
Return sb.ToString()
End Function
End Class
其中:Calculate函数中,带上A666AB682A26885DCDD57662B25048454F91F92B便会返回正确的acw_sc__v2值。